Forbid aggregate "exchange" field from non-internal clients

XMLWordPrintableJSON

    • Type: Bug
    • Resolution: Fixed
    • Priority: Major - P3
    • 8.3.3, 8.2.10, 8.0.24, 7.0.35
    • Affects Version/s: None
    • Component/s: None
    • None
    • Query Optimization
    • Fully Compatible
    • ALL
    • v8.3, v8.2, v8.0, v7.0
    • 200
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      Exchange is expected to be used by mongos communicating with mongod instances.

      Some code paths "trust" the contents of this as-if it were from a validated source i.e., there are invariants on the contents. This means external clients are able to crash mongod by supplying unexpected exchange state.

      Invariants are being investigated and changed individually, but over all exchange should not be part of the attack surface of mongod.

            Assignee:
            James Harrison
            Reporter:
            James Harrison
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: